WWBN AVideo EUVD-2026-24286

No special conditions are required for exploitation against default deployments: the attack is a single unauthenticated HTTP GET request to /git.json.php with no session, cookie, API key, or authentication header of any kind. The file imposes no access control at the PHP level and is not protected by .htaccess rules, making it reachable by any HTTP client with network access to the AVideo web root. The only limiting factor is network reachability - instances deployed behind a WAF, reverse proxy, or network firewall that blocks unauthenticated external HTTP access would mitigate internet-based exploitation, though internal network attackers would remain unaffected by such controls. No non-default configuration setting is required; the vulnerable file is present and accessible in a standard AVideo installation on versions 29.0 and prior.

The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately captures the ease of exploitation - no authentication, no user interaction, no complexity - but correctly limits severity to partial confidentiality impact since no code execution or credential theft occurs directly from this endpoint alone. EPSS at 0.03% (9th percentile) indicates low observed automated exploitation at time of analysis, which appears to reflect AVideo's niche deployment footprint rather than any inherent difficulty, since SSVC classifies the attack as Automatable:Yes - mass-scanning and automated harvesting are entirely feasible. The gap between SSVC's automatable assessment and low EPSS is consistent with limited real-world exposure of the product. No CISA KEV listing confirms no observed widespread exploitation to date. The most significant real-world risk is chained use: the returned commit hash allows precise CVE-version mapping against AVideo's extensive public advisory history (22 GHSAs), effectively converting this medium-severity disclosure into a reconnaissance amplifier that elevates the exploitability of higher-severity vulnerabilities on the same instance. No patch is available, leaving all deployments persistently exposed.

An attacker sends a single unauthenticated HTTP GET request - curl -s https://target.example/git.json.php - and receives a JSON response containing the deployed commit hash, author name, developer email address, and commit message with no authentication required. The attacker then cross-references the commit hash against AVideo's public git history and its 22 published GHSAs to determine precisely which vulnerabilities are unpatched on that instance, then stages a targeted follow-on exploit against a confirmed-unpatched higher-severity vulnerability. A working public PoC is included in the GHSA advisory and requires no tooling beyond curl.